mediumMultiple ChoiceObjective-mapped
Most Critical Risk in Unsupported Legacy Systems: Unpatched Vulnerabilities
A company operates a legacy system for which the vendor no longer provides security patches. What is the most critical risk to identify regarding this system?
Quick Answer
The answer is unpatched vulnerabilities. This is the most critical risk because a legacy system without vendor support has no mechanism to remediate known security flaws, leaving it exposed to published CVEs that attackers can exploit directly. On the CRISC exam, this concept tests your ability to prioritize risk in the context of end-of-life systems, where the absence of patches creates a permanent attack surface that threatens confidentiality, integrity, and availability. A common trap is focusing on functional obsolescence or compliance gaps, but the exam emphasizes that unpatched vulnerabilities represent an active, exploitable threat. Remember the memory tip: "No patch, no parachute"—without vendor updates, the system has no safety net against known exploits, making unpatched vulnerabilities the single highest-priority risk to identify.
⚠ Common exam trap
Test-takers frequently confuse the root cause (lack of vendor support) with the actual risk (unpatched vulnerabilities), leading them to select 'Lack of vendor support' instead of identifying the direct security exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unpatched vulnerabilities
Unpatched vulnerabilities are the most critical risk because the legacy system is exposed to known exploits that the vendor no longer addresses. Without security patches, attackers can leverage published CVEs to compromise the system, leading to data breaches or system takeover. This directly threatens the confidentiality, integrity, and availability of the system and its data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unpatched vulnerabilities
Why this is correct
Without patches, all known vulnerabilities remain exploitable, posing a high risk.
- ✗
Incompatibility with new systems
Why it's wrong here
Incompatibility is an operational risk, but security vulnerabilities are more critical.
- ✗
Lack of vendor support
Why it's wrong here
While support is lacking, the direct risk is the absence of security patches.
- ✗
Skill shortage for maintenance
Why it's wrong here
Skill shortage is a resource risk, not as directly impactful as unpatched vulnerabilities.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A retail company uses a legacy inventory system that is no longer supported by the vendor. The IT department is planning to migrate to a modern cloud-based system. During risk identification, which of the following should be considered a PRIMARY risk?
easy- A.Inadequate training of staff on the new system.
- B.Potential cost overrun due to migration complexity.
- ✓ C.Loss of data integrity during the data migration process.
- D.Failure to decommission the legacy system after migration.
Why C: Loss of data integrity during migration is the primary risk because the legacy system is unsupported, meaning there are no vendor patches or tools to validate or repair data inconsistencies. Corrupted or incomplete data transferred to the cloud-based system can lead to inaccurate inventory records, financial losses, and operational disruptions that are difficult to reverse without vendor support.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.